Site Hacking 101

[Tomred]

I tried to use it and like on step 2 when I put ' in both blanks it now gives me an error HTTP 500 Internal Server Error page cannot be displayed.
So you must have gotten his attention and inspired some changes.

Just a quick tip, for those of you not getting these particular error messages, go to your internet settings and make sure "show friendly http error messages" is not selected.

 

[the-perro]

Awesome, good job Nova. Learning something new everyday

 

[nicho]

Satya you get better each day nicho

 

[frequency]

SQL injections constantly evolving to match patches and updates. Cool post.

 

[RabidSpatula]

Laff, don't know about ASP but in PHP this is very easy to fix. Just strip all ' and " marks, then do proper slashing on all input. If you need single and double quotes, use htmlentities.

 

[FitnessGeek]

Awesome info thanks

 

[nova]

Laff, don't know about ASP but in PHP this is very easy to fix. Just strip all ' and " marks, then do proper slashing on all input. If you need single and double quotes, use htmlentities.

Some php sites have other vulnerabilities as well. You arent just limited to sql injection.. but I guess ill post that in a new tutorial.

http://tubeautomator.com/squeeze.php​